The second most senior officer at Surrey police is being investigated by the Independent Police Complaints Commission over claims he failed to act when he discovered the News of the World had hacked Milly Dowler's phone.

Deputy Chief Constable Craig Denholm, who was in overall charge of Operation Ruby – the investigation into the girl's disappearance in March 2002 – is to be the subject of an independent investigation by the police watchdog. The IPCC announced it was also investigating a second senior Surrey officer over whether she knew about the phone hacking - Detective Superintendent Maria Woodall, who was the detective chief inspector in operational charge of the Dowler investigation from 2006 onwards.

The inquiry into Denholm centres on allegations that he was aware Milly's phone had been hacked by the News of the World in 2002 and did not act then or later. Surrey police and the police authority referred his conduct to the IPCC on 21 June and the police watchdog announced on Thursday it would be carrying out an independent investigation.

The IPCC could examine whether Denholm told Metropolitan police assistant commissioner John Yates, of any knowledge about the hacking of the phone, in advance of the Scotland Yard officer's 2009 review of the original phone-hacking investigation – and if not, why not.

Denholm was working as a commander in the counter-terrorism unit at Scotland Yard under Yates in 2009. He left a month before Yates announced that the phone-hacking inquiry would not be reopened following revelations in the Guardian revealing there were potentially thousands of victims.

As the detective who had overall control of the Dowler investigation from 2002 onwards, it has been alleged that Denholm was aware the tabloid newspaper had illegally accessed information from the missing girl's phone following a meeting with two reporters from the Sunday newspaper in 2002.

In its statement, the IPCC said it was "considering whether Mr Denholm was aware during Operation Ruby that the NOTW had accessed Milly Dowler's voicemail in 2002 and his handling of that information".

An internal investigation by Surrey police for the Leveson inquiry was able to confirm that they had been aware that Milly's phone had been hacked by the paper in 2002 but failed to take any action.

Earlier this year Surrey told a select committee in a letter that an unnamed representative from the tabloid had played police a recording of a voicemail left by a recruitment agency on the missing girl's phone.

The letter said that on April 13 2002, "the press officer spoke to (name redacted) and asked him why he was so convinced that the message on Milly's voicemail was not a hoax".

"(Name redacted) response was that the NotW had got Milly's phone number and pin from schoolchildren."

The IPCC said it would also be investigating Woodall, and will examine whether she knew about the phone being hacked. The IPCC said it would focus on what information she provided to the Surrey police internal investigation.

In a statement jointly released by Surrey police and the IPCC, the Dowler family said they welcomed "the proper investigation of what happened at Surrey police 10 years ago.

"They regret that the passage of time means that some individuals can now no longer be investigated. The family have no further comment to make at this time."

Surrey police said both Denholm and Woodall remained serving officers and had not been suspended, or placed on restricted duties.

A statement from the force said: "Surrey police authority and Surrey police believe that seeking independent scrutiny into these matters at this stage is the appropriate course of action."

At Surrey, Denholm is known to be one of the main advocates of bringing more privatisation into policing and is responsible for the "risk and reputation" of the force. He is also the "champion for diversity and leadership" within the force.

Denholm was appointed deputy chief constable of Surrey – where he had previously worked for seven years – in June 2009. Before moving to Surrey for his second tenure to take up the deputy chief constable role, he spent a year at the Metropolitan police as a commander in S015, counter-terrorism, working for two months under Yates when he took over as AC counter terrorism in April 2009.

Denholm left the Met Police in June 2009 – a month before Yates's review of the original hacking investigation.

Yates ruled out reopening the investigation after his review, which lasted less than 24 hours.

Denholm – whose career started at the Met – has also worked for the National Criminal Intelligence Service (NCIS) and Hampshire constabulary.